Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption

• Tanoh@lemmy.world ⁨1⁩ ⁨hour⁩ ago

  And Signal is open source so, if it did anything weird with private keys, everyone would know

  Well, no. At least not by default as you are running a compiled version of it. Someone could inject code you don’t know anything about before compilation that for example leaked your keys.

  One way to be more confident no one has, would be to have predictable builds that you can recreate and then compare the file fingerprints. But I do not think that is possible, at least on android, as google holds they signature keys to apps.

  source

  • pressanykeynow@lemmy.world ⁨8⁩ ⁨minutes⁩ ago

    Signal has reproducible builds and here’s the instruction how to check it on Android github.com/signalapp/Signal-Android/…/README.md

    source
• REDACTED@infosec.pub ⁨7⁩ ⁨hours⁩ ago

  Well, Whatsapp uses signal. Bad timing

  source

  • Candice_the_elephant@lemmy.world ⁨3⁩ ⁨hours⁩ ago

    It only uses some of signal’s code. Not necessarily the OOTB key storage and security.

    source
  • qyron@sopuli.xyz ⁨7⁩ ⁨hours⁩ ago

    How?

    source

    • HereIAm@lemmy.world ⁨7⁩ ⁨hours⁩ ago

      WhatsApp is using Signals protocol for communication: signal.org/blog/whatsapp-complete/

      I don’t fully understand what it entails, but from what I understand is that yes, WhatsApp is using the same encryption and message flow that signal uses, but you’re still using Meta’s app, and they can just read the plaintext message from there.

      source

      • qyron@sopuli.xyz ⁨7⁩ ⁨hours⁩ ago

        To my knowledge, under Signal, the encription keys are locally generated and stored, and the traffic flows between end points as a closed packet.

        This does not seem to be the case here, as the keys are generated and stored outside your equipment and, thus, are viable to be used by a third party to access packets.

        But I admit I speak heavily burdened by technical ignorance.

        source

        • -> View More Comments
      • Candice_the_elephant@lemmy.world ⁨3⁩ ⁨hours⁩ ago

        Or they can make a copy of the encryption keys on creation. Using the code is very different than using the code unedited, or using all the code.

        source
    • Appoxo@lemmy.dbzer0.com ⁨7⁩ ⁨hours⁩ ago

      Unless proof is given, assume troll

      source

      • REDACTED@infosec.pub ⁨34⁩ ⁨minutes⁩ ago

        Read the article? An app using signal does not imply that your data is still encrypted from corporations or government. Your neighbour joe is not very likely to break already established SSL, so using signal feels like someone is trying to sell me a bridge. Sense of false security.

        source